@saltcorn/server 1.6.0-beta.5 → 1.6.0-beta.7

package/routes/plugins.js

@@ -34,6 +34,8 @@ const {
   plugin_viewtemplates_info_card,
   showRepository,
 } = require("../markup/plugin-store");
+const MarkdownIt = require("markdown-it"),
+  md = new MarkdownIt();
 const {
   h5,
   a,
@@ -56,6 +58,8 @@ const {
   text,
   script,
   domReady,
+  details,
+  summary,
 } = require("@saltcorn/markup/tags");
 const { search_bar } = require("@saltcorn/markup/helpers");
 const fs = require("fs");
@@ -189,7 +193,17 @@ const get_store_items = async (req) => {
   if (msgs.length > 0) req.flash("warning", msgs.join("<br>"));
   const packs_available = await fetch_available_packs();
   const packs_installed = getState().getConfig("installed_packs", []);
-  const installed_plugin_names = installed_plugins.map((p) => p.name);
+  const tenants_install_git = getRootState().getConfig(
+    "tenants_install_git",
+    false
+  );
+  const isGitBlocked = (p) =>
+    !isRoot &&
+    !tenants_install_git &&
+    (p.source === "git" || p.source === "github");
+  const installed_plugin_names = installed_plugins
+    .filter((p) => !isGitBlocked(p))
+    .map((p) => p.name);
   const store_plugin_names = instore.map((p) => p.name);
   const plugins_item = instore
     .map((plugin) => ({
@@ -198,6 +212,7 @@ const get_store_items = async (req) => {
       plugin: true,
       description: plugin.description,
       documentation_link: plugin.documentation_link,
+      contents: plugin.contents,
       has_theme: plugin.has_theme,
       has_auth: plugin.has_auth,
       unsafe: plugin.unsafe,
@@ -208,7 +223,12 @@ const get_store_items = async (req) => {
     }))
     .filter((p) => !p.unsafe || isRoot || tenants_unsafe_plugins);
   const local_logins = installed_plugins
-    .filter((p) => !store_plugin_names.includes(p.name) && p.name !== "base")
+    .filter(
+      (p) =>
+        !store_plugin_names.includes(p.name) &&
+        p.name !== "base" &&
+        !isGitBlocked(p)
+    )
     .map((plugin) => ({
       name: plugin.name,
       installed: true,
@@ -308,6 +328,9 @@ const store_item_html = (req) => (item) => ({
       item.ready_for_mobile && badge(req.__("Mobile"))
     ),
     div(item.description || ""),
+    item.contents
+      ? details(summary(req.__("Detailed contents")), md.render(item.contents))
+      : "",
     item.documentation_link
       ? div(
           a(
@@ -700,7 +723,8 @@ router.get(
                       label: version,
                       selected: version === selected,
                     })
-                  ).reverse()
+                  )
+                  .reverse()
               ),
               // tag
               label(
@@ -1677,3 +1701,5 @@ router.post(
     }
   })
 );
+
+router.get_store_items = get_store_items;

package/routes/sync.js

@@ -82,8 +82,12 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     ownerFieldName = ownerField.name;
   }
 
-  const maxLoadedId = Number(syncInfo.maxLoadedId);
-  if (!Number.isInteger(maxLoadedId)) throw new Error("Invalid maxLoadedId");
+  // Time-based composite cursor: (lastModifiedAt ms, lastRef string).
+  // Works for both integer and UUID primary keys.
+  const lastModifiedAt = Number(syncInfo.lastModifiedAt ?? 0);
+  if (!Number.isInteger(lastModifiedAt) || lastModifiedAt < 0)
+    throw new Error("Invalid lastModifiedAt");
+  const lastRef = String(syncInfo.lastRef ?? "");
 
   const syncUntilMs = new Date(syncUntil).valueOf();
   if (!Number.isFinite(syncUntilMs)) throw new Error("Invalid syncUntil");
@@ -94,28 +98,31 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
 
   const schema = db.getTenantSchemaPrefix();
   if (!syncInfo.syncFrom) {
-    const params = [maxLoadedId];
+    // First sync: all non-deleted rows after the cursor, ordered by
+    // (last_modified, ref) so pagination is stable across PK types.
+    const params = [lastModifiedAt / 1000.0, lastRef];
     const ownerClause = ownerFieldName
-      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $2`
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $3`
       : "";
     if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
       `select
-         info_tbl.ref "_sync_info_tbl_ref_",
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text) "_sync_info_tbl_ref_",
          info_tbl.last_modified "_sync_info_tbl_last_modified_",
-         info_tbl.deleted "_sync_info_tbl_deleted_",
+         COALESCE(info_tbl.deleted, false) "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" "info_tbl" right join "${db.sqlsanitize(
-        tblName
-      )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(
-        pkName
-      )}" and info_tbl.deleted = false
-      where data_tbl."${db.sqlsanitize(pkName)}" > $1
-      ${ownerClause}
-      order by data_tbl."${db.sqlsanitize(pkName)}"`,
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       right join "${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+         and info_tbl.deleted = false
+       where (
+           COALESCE(info_tbl.last_modified, to_timestamp(0)),
+           COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)
+         ) > (to_timestamp($1), $2)
+       ${ownerClause}
+       order by
+         COALESCE(info_tbl.last_modified, to_timestamp(0)),
+         COALESCE(info_tbl.ref, data_tbl."${db.sqlsanitize(pkName)}"::text)`,
       params
     );
     for (const row of rows) {
@@ -132,9 +139,16 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
     const syncFromMs = new Date(syncInfo.syncFrom).valueOf();
     if (!Number.isFinite(syncFromMs)) throw new Error("Invalid syncFrom");
 
-    const params = [syncFromMs / 1000.0, syncUntilMs / 1000.0, maxLoadedId];
+    // Incremental sync: rows changed in the time window, paged by
+    // (last_modified, ref) within the window.
+    const params = [
+      syncFromMs / 1000.0,
+      syncUntilMs / 1000.0,
+      lastModifiedAt / 1000.0,
+      lastRef,
+    ];
     const ownerClause = ownerFieldName
-      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $4`
+      ? `and data_tbl."${db.sqlsanitize(ownerFieldName)}" = $5`
       : "";
     if (ownerFieldName) params.push(userId);
     const { rows } = await db.query(
@@ -143,18 +157,15 @@ const getSyncRows = async (syncInfo, table, syncUntil, user) => {
          info_tbl.last_modified "_sync_info_tbl_last_modified_",
          info_tbl.deleted "_sync_info_tbl_deleted_",
          data_tbl.*
-       from ${schema}"${db.sqlsanitize(
-        tblName
-      )}_sync_info" "info_tbl" join ${schema}"${db.sqlsanitize(
-        tblName
-      )}" "data_tbl"
-      on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"
-      where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
-      and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
-      and info_tbl.deleted = false
-      and info_tbl.ref > $3
-      ${ownerClause}
-      order by info_tbl.ref`,
+       from ${schema}"${db.sqlsanitize(tblName)}_sync_info" "info_tbl"
+       join ${schema}"${db.sqlsanitize(tblName)}" "data_tbl"
+         on info_tbl.ref = data_tbl."${db.sqlsanitize(pkName)}"::text
+       where date_trunc('milliseconds', info_tbl.last_modified) > to_timestamp($1)
+         and date_trunc('milliseconds', info_tbl.last_modified) < to_timestamp($2)
+         and info_tbl.deleted = false
+         and (info_tbl.last_modified, info_tbl.ref) > (to_timestamp($3), $4)
+       ${ownerClause}
+       order by info_tbl.last_modified, info_tbl.ref`,
       params
     );
     for (const row of rows) {
@@ -215,9 +226,11 @@ router.post(
             rows.splice(rowLimit);
           }
           rowLimit -= rows.length;
+          const lastRow = rows.length > 0 ? rows[rows.length - 1] : null;
           result[tblName] = {
             rows,
-            maxLoadedId: rows.length > 0 ? rows[rows.length - 1][pkName] : 0,
+            maxModifiedAt: lastRow ? lastRow._sync_info_tbl_last_modified_ : 0,
+            maxRef: lastRow ? String(lastRow._sync_info_tbl_ref_ ?? "") : "",
           };
         }
         return result;

package/routes/tables.js

@@ -8,6 +8,7 @@ const Router = require("express-promise-router");
 
 const db = require("@saltcorn/data/db");
 const Table = require("@saltcorn/data/models/table");
+const Field = require("@saltcorn/data/models/field");
 const File = require("@saltcorn/data/models/file");
 const View = require("@saltcorn/data/models/view");
 const User = require("@saltcorn/data/models/user");
@@ -847,6 +848,18 @@ router.get(
     let fieldCard;
     const primaryKeys = fields.filter((f) => f.primary_key);
     const nPrimaryKeys = primaryKeys.length;
+    const standardFieldNames = [
+      "name",
+      "description",
+      "created_at",
+      "updated_at",
+      "created_by",
+      "updated_by",
+    ];
+    const fieldNameSet = new Set(fields.map((f) => f.name));
+    const hasAllStandardFields = standardFieldNames.every((n) =>
+      fieldNameSet.has(n)
+    );
 
     if (fields.length === 0) {
       fieldCard = [
@@ -862,6 +875,17 @@ router.get(
             },
             req.__("Add field to table")
           ),
+        !table.external &&
+          !table.provider_name &&
+          user_can_edit_tables &&
+          !hasAllStandardFields &&
+          a(
+            {
+              class: "btn btn-outline-secondary ms-2",
+              href: `javascript:ajax_modal('/table/create-standard-fields/${table.id}')`,
+            },
+            req.__("Create standard fields")
+          ),
       ];
     } else {
       const tableHtml = mkTable(
@@ -946,6 +970,17 @@ router.get(
             },
             req.__("Add field")
           ),
+        !table.external &&
+          !table.provider_name &&
+          user_can_edit_tables &&
+          !hasAllStandardFields &&
+          a(
+            {
+              class: "btn btn-outline-secondary ms-2 mt-2",
+              href: `javascript:ajax_modal('/table/create-standard-fields/${table.id}')`,
+            },
+            req.__("Create standard fields")
+          ),
       ];
     }
     let viewCard;
@@ -2682,3 +2717,134 @@ router.post(
     res.redirect(`/table/${table.id}`);
   })
 );
+
+const standardFieldDefs = (req) => [
+  {
+    name: "name",
+    label: req.__("Name"),
+    type: "String",
+    fieldType: "String",
+  },
+  {
+    name: "description",
+    label: req.__("Description"),
+    type: "String",
+    fieldType: "String",
+  },
+  {
+    name: "created_at",
+    label: req.__("Created at"),
+    type: "Date",
+    fieldType: "Date",
+    required: true,
+    attributes: { default_expression: "new Date()" },
+  },
+  {
+    name: "updated_at",
+    label: req.__("Updated at"),
+    type: "Date",
+    fieldType: "Date",
+    calculated: true,
+    stored: true,
+    expression: "new Date()",
+  },
+  {
+    name: "created_by",
+    label: req.__("Created by"),
+    type: "Key to user",
+    fieldType: "Key",
+    reftable_name: "users",
+    attributes: { default_expression: "user?.id", summary_field: "email" },
+  },
+  {
+    name: "updated_by",
+    label: req.__("Updated by"),
+    type: "Key to user",
+    fieldType: "Key",
+    reftable_name: "users",
+    calculated: true,
+    stored: true,
+    expression: "user?.id ?? row?.updated_by",
+    attributes: { summary_field: "email" },
+  },
+];
+
+const standardFieldForm = (table, req, existingNames = new Set()) => {
+  const defs = standardFieldDefs(req).filter(
+    (def) => !existingNames.has(def.name)
+  );
+  return new Form({
+    submitLabel: req.__("Create fields"),
+    action: `/table/create-standard-fields/${table.id}`,
+    formStyle: "vert",
+    fields: defs.map((def) => ({
+      type: "Bool",
+      label: `${def.label} (${def.type})`,
+      name: def.name,
+      default: true,
+    })),
+  });
+};
+
+router.get(
+  "/create-standard-fields/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_tables"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const table = Table.findOne({ id });
+    if (!table) {
+      req.flash("error", `Table not found`);
+      res.redirect(`/table`);
+      return;
+    }
+    const existingFields = await table.getFields();
+    const existingNames = new Set(existingFields.map((f) => f.name));
+    res.set("Page-Title", req.__("Create standard fields"));
+    const form = standardFieldForm(table, req, existingNames);
+    res.send(renderForm(form, req.csrfToken()));
+  })
+);
+
+router.post(
+  "/create-standard-fields/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_tables"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+    const table = Table.findOne({ id });
+    if (!table) {
+      req.flash("error", `Table not found`);
+      res.redirect(`/table`);
+      return;
+    }
+    const existingFields = await table.getFields();
+    const existingNames = new Set(existingFields.map((f) => f.name));
+    const form = standardFieldForm(table, req, existingNames);
+    form.validate(req.body || {});
+    if (form.hasErrors) {
+      req.flash("error", req.__("An error occurred"));
+      res.redirect(`/table/${table.id}`);
+      return;
+    }
+    const defs = standardFieldDefs(req);
+    await db.withTransaction(async () => {
+      for (const def of defs) {
+        if (!form.values[def.name]) continue;
+        if (existingNames.has(def.name)) continue;
+        await Field.create({
+          table_id: table.id,
+          name: def.name,
+          label: def.label,
+          type: def.fieldType,
+          reftable_name: def.reftable_name,
+          required: def.required || false,
+          calculated: def.calculated || false,
+          stored: def.stored || false,
+          expression: def.expression,
+          attributes: def.attributes || {},
+        });
+      }
+    });
+    await getState().refresh_tables();
+    res.redirect(`/table/${table.id}`);
+  })
+);

package/routes/utils.js

@@ -13,7 +13,11 @@ const {
   features,
 } = require("@saltcorn/data/db/state");
 const { get_base_url } = require("@saltcorn/data/models/config");
-const { hash } = require("@saltcorn/data/utils");
+const {
+  hash,
+  is_relative_url,
+  normalize_relative_url,
+} = require("@saltcorn/data/utils");
 const { input, script, domReady, a, text } = require("@saltcorn/markup/tags");
 const session = require("express-session");
 const cookieSession = require("cookie-session");
@@ -389,38 +393,11 @@ const addOnDoneRedirect = (oldPath, req) => {
   return oldPath;
 };
 
-const is_relative_url = (url) => {
-  if (typeof url !== "string") return false;
-
-  // Normalise backslashes to forward slashes (WHATWG treats \ as / in special schemes)
-  const normalised = url.replace(/\\/g, "/");
-
-  // Reject protocol-relative URLs (//example.com)
-  if (normalised.trimStart().startsWith("//")) return false;
-
-  // Reject any scheme: URIs (e.g. http:, javascript:, data:, vbscript:)
-  // A scheme is a letter followed by letters/digits/+/-/. then a colon (RFC 3986 §3.1)
-  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/u.test(normalised.trimStart())) return false;
-
-  return true;
-};
-
-const normalize_relative_url = (url) => {
-  if (typeof url !== "string") return null;
-
-  const normalised = url.replace(/\\/g, "/").trimStart();
-
-  // Reject protocol-relative URLs
-  if (normalised.startsWith("//")) return null;
-
-  // Reject any scheme (RFC 3986 §3.1)
-  if (/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(normalised)) return null;
-
-  return normalised;
-};
-
 const safe_redirect = (res, url, default_url) => {
-  if (!url) res.redirect(default_url);
+  if (!url) {
+    res.redirect(default_url);
+    return;
+  }
   const dest = normalize_relative_url(url);
   if (dest !== null) res.redirect(dest);
   else res.redirect(default_url);

package/serve.js

@@ -302,6 +302,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
       tenant || "public",
       msg.real_time_collab_event.type,
       msg.real_time_collab_event.data,
+      msg.real_time_collab_event.viewname,
       true
     );
   }
@@ -845,22 +846,35 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
   });
 
   // Real-time collaboration emitter (tied to views)
-  getState().setCollabEmitter((tenant, type, data) => {
-    io.of("/").to(`_${tenant}_collab_room_`).emit(type, data);
+  getState().setCollabEmitter((tenant, type, data, viewname) => {
+    io.of("/").to(`_${tenant}_collab_room_${viewname}_`).emit(type, data);
   });
 
   // dynamic updates emitter (for run_js_actions)
   getState().setDynamicUpdateEmitter((tenant, data, userIds) => {
-    if (userIds) {
+    if (userIds === null) {
+      // explicit public-only; data may carry page_load_tag for client-side filtering
+      io.of("/")
+        .to(`_${tenant}_public_dynamic_update_room`)
+        .emit("dynamic_update", data);
+    } else if (Array.isArray(userIds)) {
       for (const userId of userIds) {
         io.of("/")
           .to(`_${tenant}:${userId}_dynamic_update_room`)
           .emit("dynamic_update", data);
       }
-    } else {
+    } else if (userIds === undefined) {
+      // broadcast to all authenticated users in this tenant
       io.of("/")
         .to(`_${tenant}_dynamic_update_room`)
         .emit("dynamic_update", data);
+    } else {
+      getState().log(
+        1,
+        `setDynamicUpdateEmitter: unexpected userIds value: ${JSON.stringify(
+          userIds
+        )}`
+      );
     }
   });
 
@@ -927,9 +941,9 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const role_id = user ? user.role_id : 100;
           if (view.min_role < role_id)
             throw new Error("Not authorized to join collaboration room");
-          const roomName = `_${tenant}_collab_room_`;
+          const roomName = `_${tenant}_collab_room_${viewname}_`;
           if (!socket.rooms.has(roomName)) {
-            socket.join(`_${tenant}_collab_room_`);
+            socket.join(roomName);
             if (typeof callback === "function") callback({ status: "ok" });
             const socketIds = await getState().getConfig(
               "joined_real_time_socket_ids",
@@ -961,9 +975,12 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const enabled = getState().getConfig("enable_dynamic_updates", true);
           if (!enabled) throw new Error("Dynamic updates are not enabled");
           const user = socket.request.user;
-          if (!user) throw new Error("Not authorized");
-          socket.join(`_${tenant}_dynamic_update_room`);
-          socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          if (user) {
+            socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+            socket.join(`_${tenant}_dynamic_update_room`);
+          } else {
+            socket.join(`_${tenant}_public_dynamic_update_room`);
+          }
           const socketIds = await getState().getConfig(
             "joined_dynamic_update_socket_ids",
             []

package/tests/admin.test.js

@@ -25,7 +25,7 @@ const {
   auto_backup_now,
 } = require("@saltcorn/admin-models/models/backup");
 
-jest.setTimeout(30000);
+jest.setTimeout(30000000);
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -387,7 +387,7 @@ describe("actions", () => {
       .send("table_id=2")
       .send("name=mynewaction")
       .send("when_trigger=Insert")
-      .expect(toRedirect("/actions/configure/8"));
+      .expect(toRedirect("/actions/configure/9"));
   });
   it("show edit", async () => {
     const app = await getApp({ disableCsrf: true });
@@ -451,9 +451,9 @@ describe("actions", () => {
       .send("action=run_js_code")
       .send("when_trigger=API+call")
       .send("min_role=1")
-      .expect(toRedirect("/actions/configure/9"));
+      .expect(toRedirect("/actions/configure/10"));
     await request(app)
-      .post("/actions/configure/9")
+      .post("/actions/configure/10")
       .set("Cookie", loginCookie)
       .send("code=return 27")
       .expect(toRedirect("/actions/"));
@@ -461,7 +461,7 @@ describe("actions", () => {
       .post("/api/action/myact")
       .set("Cookie", loginCookie)
       .expect(
-        respondJsonWith(200, ({ success, data }) => success && data === 27)
+        respondJsonWith(200, ({ success, data }) => success === true && data === 27)
       );
   });
   it("deletes trigger", async () => {